Practical Issues in Teaching Computer Forensics Dr. Iain Sutherland Information Security Research Group, School of Computing.

Northumbria University The demand for courses There appears to be growth in the number of courses: Attention in the media Undergraduate –A number of new courses Postgraduate forensics and related courses –Glamorgan –Cranfield –Westminster –Royal Holloway –Bradford –University of East London + others...

Northumbria University The Practical Issues The teaching of computer forensics can present a number of practical problems relating to: Students Material Resources Staff The following slides are based on the experience of teaching computer forensics to undergraduate and postgraduate students for a number of years.

Northumbria University Do the students know we exist? A couple of searches on 26/10/05 A search for “computer forensics” A search for “computer French” They did have an advert for Northumbria University on the courses index page...

Northumbria University Students The usual issues –Mixed backgrounds / skills –Mixed ability –Mixed cultures Specific problems –What are they expecting, CSI? (without the gooey stuff) or Silent Witness? –Can they cope with the nature of the material? Both Technical and content?

Northumbria University Material The subject area is huge –Computing, forensics and psychology (and others) –The subject area is still fairly ‘young’ Potential problems of ethics –The material covered as part of the course –Case studies – certain sensitivities –Should we be teaching the students some of these skills?

Northumbria University Resources To do properly – expensive! Resources both for teaching and student projects –Hardware, including network infrastructure –Software such as AccessData or Encase etc Developing ‘case material’

Northumbria University Staff Staff issues include –Time to stay ‘current’ in the field! –Research activity / consultancy The subject area is specialised, although ISRG staff came from a variety of fields.

Northumbria University Our Solutions... Things we have found that work so far include: 1.Develop relationships with a variety of people and organisations Gain experience Advice on course content / structure Guest speakers...

Northumbria University Our Solutions 2.Initially kit out a teaching lab with free /cheap tools HOWEVER Better to do it properly – buy the real thing! Ideally a closed network with access to tools / test systems / Images

Northumbria University Our Solutions... 3.Underpin the teaching with research and/or consultancy to provide: Case studies Technical background Anecdotal information

Northumbria University Glamorgan Computer Forensics Lab To date, average laboratory running / refurbishing costs about £20K per year Set up as a research / consultancy lab and focuses on recovering data from HDD expanded to handle PDA’s and Cellular phones!

Northumbria University Practical Issues - Summary Develop relationships with Law Enforcement Agencies / business world Computer Forensics be expensive to teach in terms of time and resources so build up the kit slowly. Consider teaching material carefully for ethical issues Teaching benefits from being underpinned by consultancy / research work

Northumbria University Any Questions?